3 ms·

This looks like e2e push notifications but has warnings against p2p use, so I'm not fully sure what the use case is for this. Apologies for my ignorance - maybe

This looks like e2e push notifications but has warnings against p2p use, so I'm not fully sure what the use case is for this. Apologies for my ignorance - maybe someone can explain this relative to GCM, FireChat, XMPP, or Signal?

firloop 8y ago
By default, both Google and Apple can read the content of messages over their respective push services. This allows a service to send push messages to its users without Google being privvy to the content of the messages. I guess it's not ready for P2P use yet (aka encrypting the messages with a key unknown to $Service) but could still be useful for telling a user that "Jane sent you a message" without leaking the fact that John is communicating with Jane.
- Multicomp 8y ago
  Thanks, that clears things up a lot more.
- chatmasta 8y ago
  So if I have signal on iOS configured to use notifications (which include the body of the message), those notifications are sent unencrypted over apple’s push notification system? Some quick googling let me to this SO answer [0] suggesting that as of 2016 devs can configure APNS as an encrypted channel where the client decrypts notification payloads locally. [0] https://stackoverflow.com/questions/32719476/how-secure-are-apple-apns-push-notifications https://stackoverflow.com/questions/32719476/how-secure-are-...
  - firloop 8y ago
    Your link is correct -- Apple recently added the ability to programmatically modify the contents of push notifications which would allow one to build E2E on top of APNS. Android has always processed notifications through intents, so it's always had this capability. Google is just providing a pre built solution that works for some use cases but this method was technically possible before. Not sure what Signal does here particularly, but their FAQ claims it's not a problem. https://support.signal.org/hc/en-us/articles/217524107-Can-Google-read-my-messages-Can-Apple-read-my-messages- https://support.signal.org/hc/en-us/articles/217524107-Can-G...
    - KAMSPioneer 8y ago
      I've read from the Signal team before (no reference links on hand, sorry) that Signal servers send an empty push notification to your device to wake it up, at which point the Signal app fetches your notifications/messages from Signal's servers. At least, that's what I read for Android/GCM, I'm not sure if that applies to Apple.
      - iampims 8y ago
        I believe they’re referred as “Silent notifications” on iOS. It’s very convenient to update state in the app without having to wait for the user to perform the action manually.
      - tssva 8y ago
        Which would be consistent with most messaging apps that use notifications. Although I'm sure there is an exception to the rule most only use notifications to indicate to the client that a new message is available on the server.

firloop 8y ago

By default, both Google and Apple can read the content of messages over their respective push services. This allows a service to send push messages to its users without Google being privvy to the content of the messages. I guess it's not ready for P2P use yet (aka encrypting the messages with a key unknown to $Service) but could still be useful for telling a user that "Jane sent you a message" without leaking the fact that John is communicating with Jane.

Multicomp 8y ago
Thanks, that clears things up a lot more.
chatmasta 8y ago
So if I have signal on iOS configured to use notifications (which include the body of the message), those notifications are sent unencrypted over apple’s push notification system? Some quick googling let me to this SO answer [0] suggesting that as of 2016 devs can configure APNS as an encrypted channel where the client decrypts notification payloads locally. [0] https://stackoverflow.com/questions/32719476/how-secure-are-apple-apns-push-notifications https://stackoverflow.com/questions/32719476/how-secure-are-...
- firloop 8y ago
  Your link is correct -- Apple recently added the ability to programmatically modify the contents of push notifications which would allow one to build E2E on top of APNS. Android has always processed notifications through intents, so it's always had this capability. Google is just providing a pre built solution that works for some use cases but this method was technically possible before. Not sure what Signal does here particularly, but their FAQ claims it's not a problem. https://support.signal.org/hc/en-us/articles/217524107-Can-Google-read-my-messages-Can-Apple-read-my-messages- https://support.signal.org/hc/en-us/articles/217524107-Can-G...
  - KAMSPioneer 8y ago
    I've read from the Signal team before (no reference links on hand, sorry) that Signal servers send an empty push notification to your device to wake it up, at which point the Signal app fetches your notifications/messages from Signal's servers. At least, that's what I read for Android/GCM, I'm not sure if that applies to Apple.
    - iampims 8y ago
      I believe they’re referred as “Silent notifications” on iOS. It’s very convenient to update state in the app without having to wait for the user to perform the action manually.
    - tssva 8y ago
      Which would be consistent with most messaging apps that use notifications. Although I'm sure there is an exception to the rule most only use notifications to indicate to the client that a new message is available on the server.